Privacy Policy

HB Games & Cards is a sole proprietorship owned and operated by Harm Buwalda, based in the Netherlands. We sell Yu-Gi-Oh! trading cards, sealed products, and accessories through our online store.

For any privacy-related questions, you can reach us at: contact@hbgamesandcards.com

We collect and process the following categories of personal data:

• Contact details: name, email address, and phone number
• Shipping information: delivery address, including street, city, postal code, and country
• Billing information: billing address and payment method details (processed securely by our payment providers)
• Order history: products purchased, dates, amounts, and shipping tracking information
• Technical data: IP address, browser type, device information, and cookies (see section 9)

We do not collect or process any special categories of personal data (such as health data, racial or ethnic origin, or biometric data).

We process your personal data for the following lawful purposes:

• To fulfill orders: We need your name, address, and contact details to process, ship, and deliver your purchases. This is necessary for the performance of our contract with you.
• Customer communication: We use your email to send order confirmations, shipping updates, and respond to inquiries.
• Legal compliance: We retain order records to comply with Dutch and EU tax and accounting obligations.
• Fraud prevention: We may use transaction data to detect and prevent fraudulent activity.
• Website improvement: With your consent, we use analytics to understand how visitors use our site (see section 6).

We do not use your personal data for direct marketing, newsletters, or promotional emails. We currently do not operate any email marketing campaigns.

When you contact us about an order or submit a withdrawal request through our Returns & Withdrawal page, we process your personal data for the following additional purposes:

• Returns: verifying your order, arranging the return of goods, and inspecting returned items.
• Refunds: processing reimbursements through the original payment method, and keeping records for accounting purposes.
• Withdrawal requests: handling your statutory right of withdrawal under Dutch and EU consumer protection law.
• Customer support related to orders: answering questions, resolving disputes, and providing assistance regarding your purchase.

The legal bases for this processing are the performance of our contract with you and compliance with our legal obligations (including consumer protection and tax law).

We do not store or process your payment card details directly. All payments are handled by secure third-party payment processors, which may include:

• Shopify Payments
• PayPal
• iDEAL (via integrated payment providers)
• Credit and debit card providers (Visa, Mastercard, etc.)

These providers are responsible for the secure handling of your payment information in accordance with PCI-DSS standards. When you make a payment, your financial data is encrypted and transmitted directly to the payment processor. We only receive confirmation that the payment was successful, along with a transaction reference.

To deliver your orders, we share your name, address, email, and phone number with our shipping partners:

• PostNL: For domestic and international deliveries within and from the Netherlands
• DHL: For international and express deliveries

These carriers process your data solely for the purpose of delivering your parcel and providing tracking services. They are contractually bound to handle your data in compliance with applicable data protection laws.

We may use Google Analytics to understand how visitors interact with our website. This helps us improve our store experience and identify technical issues.

Google Analytics collects information such as:

• Pages visited and time spent on each page
• Referring websites or search terms
• Device and browser information
• Approximate geographic location (at city level)

Google Analytics data is anonymized where possible and is not used to identify individual users. You can opt out of Google Analytics tracking by using the browser add-on provided by Google or by adjusting your cookie preferences.

We retain your personal data only for as long as necessary:

• Order and customer records: Retained for 7 years to comply with Dutch tax and accounting laws.
• Shipping and tracking data: Retained for 2 years for dispute resolution and warranty claims.
• Analytics data: Retained for up to 26 months in Google Analytics, after which it is automatically deleted.
• Cookie and browsing data: Retained in accordance with your browser settings and cookie consent choices.

After the retention period expires, your personal data is securely deleted or anonymized so that it can no longer be linked to you.

As an EU-based business, we comply with the General Data Protection Regulation (GDPR). If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): You can request deletion of your data, subject to legal retention obligations.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing (though we do not engage in direct marketing).
• Right to withdraw consent: Where processing is based on consent (e.g., analytics cookies), you can withdraw it at any time.

To exercise any of these rights, please contact us at: contact@hbgamesandcards.com. We will respond within 30 days of receiving your request.

You also have the right to lodge a complaint with the Dutch Data Protection Authority ( Autoriteit Persoonsgegevens) if you believe your rights have been violated.

Our website uses cookies and similar technologies for the following purposes:

• Essential cookies: Necessary for the website to function, such as maintaining your shopping cart and session. These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site (e.g., Google Analytics). These are only placed with your consent.
• Preference cookies: Remember your settings and choices for a better experience.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies may prevent you from using certain features of our store, such as adding items to your cart.

We rely on the following third-party services to operate our store:

• Shopify: Our e-commerce platform, which hosts our store and processes orders.
• Google Analytics: For website analytics and performance monitoring.
• PostNL / DHL: For shipping and delivery services.
• Payment processors: Including Shopify Payments, PayPal, iDEAL providers, and card networks for secure payment handling.

Each of these providers processes your data under their own privacy policies and in compliance with GDPR. We only share the minimum data necessary for them to perform their services.

We take appropriate technical and organizational measures to protect your personal data:

• Our website uses SSL/TLS encryption to secure data transmitted between your browser and our servers.
• Payment information is handled by PCI-DSS compliant providers and is never stored on our servers.
• Access to customer data is limited to what is necessary for order fulfillment and customer support.
• We regularly review our security practices to maintain a high standard of protection.

While we take all reasonable precautions, no internet transmission is completely secure. If you have reason to believe your data has been compromised, please contact us immediately.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

We aim to respond to all privacy-related inquiries within 48 hours.